
A. All traffic destined for network 172.16.150.0 will be denied due to the implicit deny all.
B. All traffic from network 10.0.0.0 will be permitted.
C. Access-list 101 will prevent address spoofing from interface E0.
D. This is a misconfigured ACL resulting in traffic not being allowed into the router in interface S0.
E. This ACL will prevent any host on the Internet from spoofing the inside network address as the
source address for packets coming into the router from the Internet.
Answer: C
QUESTION NO: 7
Which of these can be used to authenticate the IPsec peers during IKE Phase 1?
A. Diffie-Hellman Nonce
B. pre-shared key
C. XAUTH
D. integrity check value
E. ACS
F. AH
Answer: B
Explanation:
Internet Key Exchange (IKE) executes the following phases:
+ IKE Phase 1: Two IPsec peers perform the initial negotiation of SAs. Phase 1 generates an
Internet Security Association and Key Management Protocol (ISAKMP) SA, used for management
traffic. Public key techniques or, alternatively, a pre-shared key, are used to mutually authenticate
the communicating parties. Phase 1 operates in either Main Mode or Aggressive Mode. Main
Mode protects the identity of the peers, Aggressive Mode does not.
+ IKE Phase 2: SAs are negotiated by the IKE process ISAKMP on behalf of other services, such
as IPsec, that need encryption key material for operation. IKE Phase 2 is used to build IPsec SAs,
which are for passing end-user data. Additional service negotiations occur in IKE Phase 1, DPD,
Mode Config, and so on
QUESTION NO: 8
Which description about asymmetric encryption algorithms is correct?
A. They use the same key for encryption and decryption of data.
B. They use different keys for decryption but the same key for encryption of data.
C. They use different keys for encryption and decryption of data.
Cisco 640-553: Practice Exam
10
http://certkill.com